Minimum access is to "not" change/alter/modify Group policy. By default, asnoted by other respondents, any user can join 10 client machines to thedomain. If you change either GPO or install Ipsec/certificate serverrequirements that can change. Ipsec certificate requirements could requireenrollment, which could be either automatic or require approval fromauthorized group or administrators.